eval-quality 0.2.0 → 0.3.0

package/dist/core/compile/interface-inventory.js

@@ -2,14 +2,24 @@
  * Checks interface kinds, inventory-wide operation signatures, and step input
  * bindings against each operation's request shape.
  */
+import { boundChannelsOf, declaredArtifactsOf, descriptorArtifactOf, isCommandOperation, requestShapeOf, } from '../declared-inputs.js';
 import { StructuralFailure } from '../failure-codes.js';
-import { TRANSPORT_CHANNELS } from '../schemas/pointer.js';
-import { buildPlanIndex } from '../seal/plan-index.js';
-/** Rejects permitted interface kinds that this contract version cannot run. */
+import { operationsOf } from '../schemas/interface.js';
+import { anyOperationOf, buildPlanIndex, parseEvidenceTarget, } from '../seal/plan-index.js';
+import { forEachArtifactPointer } from './reachability.js';
+/**
+ * Rejects permitted interface kinds whose probe semantics are undeclared.
+ *
+ * AD-10 closed all three non-api kinds and named the condition for opening
+ * one: the semantics have to be declared. They are declared for `cli`, so it
+ * runs; `web` and `mcp` are still undeclared and still fail here, which is
+ * what keeps this code fireable and keeps AD-10's sentence true of them.
+ */
+const SUPPORTED_INTERFACE_KINDS = ['api', 'cli'];
 export function checkInterfaceKind(contract) {
     for (const iface of contract.permittedInterfaces) {
-        if (iface.kind !== 'api') {
-            throw new StructuralFailure('unsupported-interface-kind', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].kind`, `"${iface.kind}" is not supported in v0; only "api" is (AD-10)`);
+        if (!SUPPORTED_INTERFACE_KINDS.includes(iface.kind)) {
+            throw new StructuralFailure('unsupported-interface-kind', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].kind`, `"${iface.kind}" is not supported; "api" and "cli" are (AD-10)`);
         }
     }
 }
@@ -26,12 +36,36 @@ const erase = (pathTemplate) => pathTemplate.replace(PARAMETER_SEGMENT_PATTERN,
 export function operationSignature(operation) {
     return `${operation.method} ${erase(operation.pathTemplate)}`;
 }
+/**
+ * The separator between a command's executable and each subcommand segment,
+ * declared once so the contract side and AD-40's corpus side cannot disagree
+ * about it. A space, matching the way the identity is written on a terminal.
+ */
+export const COMMAND_SIGNATURE_SEPARATOR = ' ';
+/**
+ * The command counterpart of `operationSignature`, compared literally.
+ *
+ * There is no erasure step. A subcommand path carries no parameters: a
+ * command's variable inputs are its arguments and options, which live in the
+ * request shape. Erasing a subcommand segment would make `tool review` and
+ * `tool report` one signature, which is the opposite of what erasure is for.
+ */
+export function commandSignature(operation) {
+    return [
+        operation.invocation.executable,
+        ...operation.invocation.subcommandPath,
+    ].join(COMMAND_SIGNATURE_SEPARATOR);
+}
+/** The transport identity of an operation of either kind. */
+export const anyOperationSignature = (operation) => isCommandOperation(operation)
+    ? commandSignature(operation)
+    : operationSignature(operation);
 /** Finds duplicate method and path signatures across the full inventory. */
 export function checkDuplicateOperationSignature(contract) {
     const seen = new Map();
     for (const iface of contract.permittedInterfaces) {
-        for (const operation of iface.operations) {
-            const signature = operationSignature(operation);
+        for (const operation of operationsOf(iface)) {
+            const signature = anyOperationSignature(operation);
             const collision = seen.get(signature);
             if (collision !== undefined) {
                 throw new StructuralFailure('duplicate-operation-signature', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].operations[operationId=${operation.operationId}]`, `collides with permittedInterfaces[logicalId=${collision.logicalId}].operations[operationId=${collision.operation.operationId}] after parameter-name erasure ("${signature}") (AD-19, AD-40)`);
@@ -40,6 +74,44 @@ export function checkDuplicateOperationSignature(contract) {
         }
     }
 }
+/**
+ * `unresolved-artifact-reference`: an artifact identifier nothing declares.
+ *
+ * Two sites name one: an evidence pointer's identifier segment, and a command
+ * operation's own `descriptorChannel` when it nominates an artifact. Both are
+ * authoring faults the compiler can see, and both take a code rather than
+ * resolving `absent`, on AD-26's own precedent for a dangling reference-set
+ * identifier: `absent` is defined over pointers that do not resolve against
+ * observed evidence, and a dangling declaration is neither.
+ */
+export function checkArtifactReferences(contract) {
+    for (const iface of contract.permittedInterfaces) {
+        for (const operation of operationsOf(iface)) {
+            const declared = declaredArtifactsOf(operation);
+            const nominated = descriptorArtifactOf(operation);
+            if (nominated !== null && !declared.includes(nominated)) {
+                throw new StructuralFailure('unresolved-artifact-reference', `EvalContract.permittedInterfaces[logicalId=${iface.logicalId}].operations[operationId=${operation.operationId}].descriptorChannel.artifactId`, `nominates "${nominated}", which this operation does not declare it writes (AD-19, AD-26)`);
+            }
+        }
+    }
+    const index = buildPlanIndex(contract.interactionPlan, contract.permittedInterfaces, { duplicateIds: 'unresolved' });
+    forEachArtifactPointer(contract, (pointer, path) => {
+        const target = parseEvidenceTarget(pointer);
+        if (target.artifactId === null)
+            return;
+        const step = index.stepOf(target.stepId);
+        if (step === undefined)
+            return;
+        const operation = anyOperationOf(index, step.operationId);
+        // An unresolvable step or operation is `unreachable-check-evidence`'s,
+        // at a higher rung; this check has nothing to compare against.
+        if (operation === undefined)
+            return;
+        if (declaredArtifactsOf(operation).includes(target.artifactId))
+            return;
+        throw new StructuralFailure('unresolved-artifact-reference', path, `"${pointer}" names the "${target.artifactId}" artifact, which operation "${operation.operationId}" does not declare it writes (AD-26)`);
+    });
+}
 /**
  * Checks each binding key against its operation's request shape, and each
  * `{ principal }` value against the contract's declared principals.
@@ -59,14 +131,19 @@ export function checkUndeclaredMandatoryInput(contract) {
     const index = buildPlanIndex(contract.interactionPlan, contract.permittedInterfaces, { duplicateIds: 'unresolved' });
     const principals = new Set(Object.keys(contract.testData.principals ?? {}));
     for (const step of contract.interactionPlan) {
-        const operation = index.operationOf(step.operationId);
+        const operation = anyOperationOf(index, step.operationId);
         if (operation === undefined)
             continue;
-        for (const channel of TRANSPORT_CHANNELS) {
-            const binding = step.inputBinding[channel];
+        for (const { channel, bound: binding } of boundChannelsOf(step.inputBinding)) {
             if (binding === null)
                 continue;
-            const { requiredKeys, permittedKeys } = operation.requestShape[channel];
+            const shape = requestShapeOf(operation, channel);
+            // A step binding a channel of the other kind has no declared shape
+            // to answer to. Reporting it as an undeclared input is true as far
+            // as it goes: the operation declares no such channel, and so
+            // declares no such key on it.
+            const requiredKeys = shape?.requiredKeys ?? [];
+            const permittedKeys = shape?.permittedKeys ?? [];
             for (const key of Object.keys(binding)) {
                 const path = `EvalContract.interactionPlan[stepId=${step.stepId}].inputBinding.${channel}[${JSON.stringify(key)}]`;
                 if (!requiredKeys.includes(key) && !permittedKeys.includes(key)) {

package/dist/core/compile/reachability.d.ts

@@ -1,7 +1,17 @@
 import type { EvalContract } from '../schemas/eval-contract.ts';
 import type { Expression } from '../schemas/expression.ts';
-import type { Operation } from '../schemas/interface.ts';
+import type { AnyOperation } from '../schemas/interface.ts';
 import { type PlanIndex } from '../seal/plan-index.ts';
+/**
+ * Every interaction-rooted pointer the contract writes down, wherever it sits:
+ * an oracle's check and its direction's evidence targets, a rubric criterion's
+ * evidence, and each operation's sensitivity-witness relation.
+ *
+ * Broader than `forEachCheckPointer`, which walks oracle checks alone, because
+ * an artifact identifier is an authoring fault at every site that names one and
+ * a check that walked only the checks would report half of them.
+ */
+export declare function forEachArtifactPointer(contract: EvalContract, visit: (pointer: string, artifactPath: string) => void): void;
 export declare function checkBoundElementScope(contract: EvalContract): void;
 /** `checkBoundElementScope` over one bare `Expression`. */
 export declare function checkExpressionBoundElementScope(expression: Expression, artifactPath: string): void;
@@ -13,7 +23,7 @@ export declare function checkExpressionBoundElementScope(expression: Expression,
  */
 export declare function forEachExpressionPointer(expression: Expression, visit: (pointer: string, path: string) => void): void;
 /** `checkEvidenceReachability` over one bare `Expression` and one operation. */
-export declare function checkExpressionEvidenceReachability(expression: Expression, artifactPath: string, operation: Operation): void;
+export declare function checkExpressionEvidenceReachability(expression: Expression, artifactPath: string, operation: AnyOperation): void;
 type ReachabilityResult = {
     readonly reachable: true;
 } | {

package/dist/core/compile/reachability.js

@@ -7,10 +7,12 @@
  * `evaluatePointerReachability` is exported separately as the non-throwing
  * per-pointer core, for reuse and direct testing.
  */
+import { declaredArtifactsOf, descriptorArtifactOf, descriptorChannelOf, isCommandOperation, requestShapeOf, } from '../declared-inputs.js';
 import { ARRAY_INDEX_PATTERN } from '../evaluate/evidence-resolution.js';
 import { StructuralFailure } from '../failure-codes.js';
+import { operationsOf } from '../schemas/interface.js';
 import { JsonTypeName } from '../schemas/primitives.js';
-import { buildPlanIndex, parseEvidenceTarget, } from '../seal/plan-index.js';
+import { anyOperationOf, buildPlanIndex, parseEvidenceTarget, } from '../seal/plan-index.js';
 function visitOperand(operand, path, insideQuantifier, visit) {
     if ('pointer' in operand)
         visit({ pointer: operand.pointer, path, insideQuantifier });
@@ -52,6 +54,42 @@ function forEachCheckPointer(contract, visit) {
         visitExpression(oracle.check, 'check', false, (site) => visit(site, oracle.id));
     });
 }
+/**
+ * Every interaction-rooted pointer the contract writes down, wherever it sits:
+ * an oracle's check and its direction's evidence targets, a rubric criterion's
+ * evidence, and each operation's sensitivity-witness relation.
+ *
+ * Broader than `forEachCheckPointer`, which walks oracle checks alone, because
+ * an artifact identifier is an authoring fault at every site that names one and
+ * a check that walked only the checks would report half of them.
+ */
+export function forEachArtifactPointer(contract, visit) {
+    const seen = (pointer, artifactPath) => {
+        if (pointer.startsWith('@'))
+            return;
+        visit(pointer, artifactPath);
+    };
+    contract.oracles.forEach((oracle) => {
+        if (oracle.check !== null)
+            visitExpression(oracle.check, 'check', false, (site) => seen(site.pointer, `EvalContract.oracles[id=${oracle.id}].${site.path}`));
+        oracle.direction?.evidenceTargets.forEach((target, index) => {
+            seen(target, `EvalContract.oracles[id=${oracle.id}].direction.evidenceTargets[${index}]`);
+        });
+    });
+    contract.rubrics.forEach((rubric) => {
+        rubric.criteria.forEach((criterion) => {
+            seen(criterion.evidence, `EvalContract.rubrics[id=${rubric.id}].criteria[id=${criterion.id}].evidence`);
+        });
+    });
+    contract.permittedInterfaces.forEach((iface, interfaceIndex) => {
+        operationsOf(iface).forEach((operation, operationIndex) => {
+            const witness = operation.sensitivityWitness;
+            if (witness === null)
+                return;
+            visitExpression(witness.relation, 'relation', false, (site) => seen(site.pointer, `EvalContract.permittedInterfaces[${interfaceIndex}].operations[${operationIndex}].sensitivityWitness.${site.path}`));
+        });
+    });
+}
 // ---- malformed-operator-expression: @/ outside any quantifier -----------
 export function checkBoundElementScope(contract) {
     forEachCheckPointer(contract, (site, oracleId) => {
@@ -125,12 +163,50 @@ export function evaluatePointerReachability(pointer, index) {
     if (step === undefined) {
         return unreachable('names a step the interaction plan does not declare');
     }
-    const operation = index.operationOf(step.operationId);
+    const operation = anyOperationOf(index, step.operationId);
     if (operation === undefined) {
         return unreachable(`names step "${target.stepId}", which names operation "${step.operationId}", not declared by any permitted interface`);
     }
     return evaluateReachabilityAgainstOperation(pointer, operation);
 }
+/**
+ * Descent through the operation's response descriptor, from whichever channel
+ * that descriptor describes. `channel` is carried only so the reason names the
+ * pointer's own root back to the author.
+ */
+function descendThroughDescriptor(descriptor, target, operationId, channel) {
+    if (target.tail.length === 0)
+        return reachable();
+    const firstToken = target.tail[0];
+    if (firstToken === undefined) {
+        // Unreachable: the length check above guarantees an element.
+        throw new TypeError('evidence-target tail is non-empty but has no first token');
+    }
+    const { requiredKeys, permittedKeys, types, collectionLocations } = descriptor;
+    // A root-declared collection (`pointer: ''`) indexes directly, bypassing
+    // the key check below. `expectedCardinality` bounds the array size
+    // (`exact` is the true count; `at-most`/`page-bounded` is an upper
+    // bound), so an index at or past it is unreachable.
+    const rootCollection = collectionLocations?.find((location) => location.pointer === '');
+    if (rootCollection !== undefined && ARRAY_INDEX_PATTERN.test(firstToken)) {
+        const { expectedCardinality } = rootCollection;
+        const bound = expectedCardinality.mode === 'exact'
+            ? expectedCardinality.count
+            : expectedCardinality.max;
+        if (Number(firstToken) >= bound) {
+            return unreachable(`addresses ${channel} index ${firstToken}, out of bounds for the declared root collection's expectedCardinality (${expectedCardinality.mode} ${bound})`);
+        }
+        return reachable();
+    }
+    if (!requiredKeys.includes(firstToken) &&
+        !permittedKeys.includes(firstToken)) {
+        return unreachable(`addresses ${channel} field "${firstToken}", which operation "${operationId}" declares in neither requiredKeys nor permittedKeys`);
+    }
+    if (descendsIntoDeclaredScalar(types, target.tail, firstToken)) {
+        return unreachable(`descends into ${channel} field "${firstToken}", which operation "${operationId}" declares a scalar with no further structure`);
+    }
+    return reachable();
+}
 /**
  * The same rules, against an operation the caller already resolved. Without
  * this check a probe-side condition addressing an undeclared channel or key
@@ -142,47 +218,54 @@ function evaluateReachabilityAgainstOperation(pointer, operation) {
     if (pointer.startsWith('@'))
         return reachable();
     const target = parseEvidenceTarget(pointer);
-    if (target.channel === 'stdout' || target.channel === 'stderr') {
-        // stdout/stderr are always bare strings. A non-empty tail proves the
-        // pointer unreachable.
-        if (target.tail.length > 0) {
-            return unreachable(`addresses a field inside ${target.channel}, which never carries structure to descend into`);
+    const descriptorChannel = descriptorChannelOf(operation);
+    const command = isCommandOperation(operation);
+    if (target.channel === 'artifact') {
+        const { artifactId } = target;
+        if (artifactId === null) {
+            // Unreachable: parseEvidenceTarget's own guarantee.
+            throw new TypeError('artifact evidence target names no artifact');
         }
-        return reachable();
-    }
-    if (target.channel === 'response-body') {
-        if (target.tail.length === 0)
-            return reachable();
-        const firstToken = target.tail[0];
-        if (firstToken === undefined) {
-            // Unreachable: the length check above guarantees an element.
-            throw new TypeError('evidence-target tail is non-empty but has no first token');
+        // An identifier the operation does not declare produces no evidence, so
+        // it is unreachable and this says so. `checkArtifactReferences` runs
+        // earlier in `compile` and reports the more specific
+        // `unresolved-artifact-reference` for a contract, so the two never race
+        // there; this answer is the only one on the probe side, where that check
+        // does not run because it walks a contract rather than a signature.
+        if (!declaredArtifactsOf(operation).includes(artifactId)) {
+            return unreachable(`names the "${artifactId}" artifact, which operation "${operation.operationId}" does not declare it writes`);
         }
-        const { requiredKeys, permittedKeys, types, collectionLocations } = operation.responseDescriptor;
-        // A root-declared collection (`pointer: ''`) indexes directly, bypassing
-        // the key check below. `expectedCardinality` bounds the array size
-        // (`exact` is the true count; `at-most`/`page-bounded` is an upper
-        // bound), so an index at or past it is unreachable.
-        const rootCollection = collectionLocations?.find((location) => location.pointer === '');
-        if (rootCollection !== undefined && ARRAY_INDEX_PATTERN.test(firstToken)) {
-            const { expectedCardinality } = rootCollection;
-            const bound = expectedCardinality.mode === 'exact'
-                ? expectedCardinality.count
-                : expectedCardinality.max;
-            if (Number(firstToken) >= bound) {
-                return unreachable(`addresses response-body index ${firstToken}, out of bounds for the declared root collection's expectedCardinality (${expectedCardinality.mode} ${bound})`);
+        if (artifactId !== descriptorArtifactOf(operation)) {
+            // Declared to exist, and nothing declares its structure: the
+            // operation's one descriptor describes a different channel.
+            if (target.tail.length > 0) {
+                return unreachable(`addresses a field inside the "${artifactId}" artifact, which operation "${operation.operationId}" declares it writes but declares no structure for`);
             }
             return reachable();
         }
-        if (!requiredKeys.includes(firstToken) &&
-            !permittedKeys.includes(firstToken)) {
-            return unreachable(`addresses response-body field "${firstToken}", which operation "${operation.operationId}" declares in neither requiredKeys nor permittedKeys`);
-        }
-        if (descendsIntoDeclaredScalar(types, target.tail, firstToken)) {
-            return unreachable(`descends into response-body field "${firstToken}", which operation "${operation.operationId}" declares a scalar with no further structure`);
+        return descendThroughDescriptor(operation.responseDescriptor, target, operation.operationId, `the "${artifactId}" artifact`);
+    }
+    // The declared output channel descends through the descriptor whatever it
+    // is called. This is the one rule; the channels below are the cases where
+    // no descriptor applies.
+    if (target.channel === descriptorChannel) {
+        return descendThroughDescriptor(operation.responseDescriptor, target, operation.operationId, target.channel);
+    }
+    if (target.channel === 'stdout' || target.channel === 'stderr') {
+        // The stream this operation's descriptor does not describe carries no
+        // declared structure, so a non-empty tail proves the pointer
+        // unreachable.
+        if (target.tail.length > 0) {
+            return unreachable(`addresses a field inside ${target.channel}, which operation "${operation.operationId}" declares no structure for`);
         }
         return reachable();
     }
+    if (command &&
+        (target.channel === 'response-body' ||
+            target.channel === 'response-headers' ||
+            target.channel === 'response-status')) {
+        return unreachable(`addresses ${target.channel} on operation "${operation.operationId}", which runs behind a command and produces no HTTP response`);
+    }
     if (target.channel === 'call-inputs') {
         if (target.tail.length === 0)
             return reachable();
@@ -195,7 +278,11 @@ function evaluateReachabilityAgainstOperation(pointer, operation) {
         if (firstToken === undefined) {
             throw new TypeError('evidence-target tail is non-empty but has no first token');
         }
-        const { requiredKeys, permittedKeys, types } = operation.requestShape[transportChannel];
+        const shape = requestShapeOf(operation, transportChannel);
+        if (shape === undefined) {
+            return unreachable(`addresses call-inputs ${transportChannel}, a channel operation "${operation.operationId}" does not accept input on`);
+        }
+        const { requiredKeys, permittedKeys, types } = shape;
         if (!requiredKeys.includes(firstToken) &&
             !permittedKeys.includes(firstToken)) {
             return unreachable(`addresses call-inputs ${transportChannel} field "${firstToken}", which operation "${operation.operationId}" declares in neither requiredKeys nor permittedKeys`);

package/dist/core/compile/schema-version.d.ts

@@ -0,0 +1,2 @@
+/** `schema-version-mismatch`: the stamp is not the version this build reads. */
+export declare function checkSchemaVersion(stamped: number, accepted: number, artifactPath: string): void;

package/dist/core/compile/schema-version.js

@@ -0,0 +1,25 @@
+/**
+ * AD-11's version equality, performed by the one reader that has the contract.
+ *
+ * AD-11's rule is that "readers accept an equal `schemaVersion` only and throw
+ * `schema-version-mismatch` outside that". `lineage.ts` deliberately keeps the
+ * field a plain integer rather than a literal, so that a wrong version arrives
+ * as AD-28's named fault instead of an anonymous parse failure, which puts the
+ * comparison on whoever reads the artifact. For the eval contract nobody did:
+ * a contract stamped 3 parsed, compiled, sealed, and put its stale version into
+ * the scoring version digest, and AD-11 exists to keep that number comparable.
+ *
+ * `RuntimeFault` rather than `StructuralFailure`, against the grain of every
+ * other check in this directory. The two registries are disjoint by the
+ * Consistency Conventions, AD-5 has no version code, and AD-11 names
+ * `schema-version-mismatch` literally. Minting an AD-5 twin would give one
+ * condition two codes and make a caller's handler depend on which reader
+ * happened to notice first.
+ */
+import { RuntimeFault } from '../schemas/faults.js';
+/** `schema-version-mismatch`: the stamp is not the version this build reads. */
+export function checkSchemaVersion(stamped, accepted, artifactPath) {
+    if (stamped === accepted)
+        return;
+    throw new RuntimeFault('schema-version-mismatch', artifactPath, `carries "schemaVersion" ${stamped} where this build reads ${accepted}; a contract written for another version is not read leniently, since its stale version would travel into the scoring version (AD-11)`);
+}

package/dist/core/compile/sensitivity-witness.d.ts

@@ -4,26 +4,45 @@
  * execute it, and that its leg identifiers are distinct from each other and
  * from every interaction-plan step.
  *
- * No new AD-5 code is minted. The registry is closed at twenty-three and
- * `check:ad5-registry` pins it against the spine, so each defect below takes the
- * code that already names it. Two rows stretch that reading: a leg-id equality
+ * No new AD-5 code is minted here. `check:ad5-registry` pins the registry
+ * against the spine's own table, so each defect below takes the code that
+ * already names it. Two rows stretch that reading: a leg-id equality
  * and a leg-id/step-id collision are identifier collisions, and
  * `malformed-operator-expression` is the closest available code because the
  * relation is illegal in its position once its operands cannot be told apart.
  */
 import { declaresNoRequestKeys } from '../declared-inputs.ts';
 import type { EvalContract } from '../schemas/eval-contract.ts';
-import type { Operation } from '../schemas/interface.ts';
-import { type TransportChannelName } from '../schemas/pointer.ts';
-import type { WitnessInputs } from '../schemas/sensitivity-witness.ts';
+import type { AnyOperation } from '../schemas/interface.ts';
+import type { InputChannelName } from '../schemas/pointer.ts';
+import { type ApiWitnessInputs, type WitnessChannel, type WitnessInputs } from '../schemas/sensitivity-witness.ts';
 export { declaresNoRequestKeys };
 /**
- * The keys one set of witness inputs supplies on one channel. A body that is
- * absent, or JSON that is not an object, supplies no keys: the channel is
- * declared as a keyed shape, so such a leg omits every required key rather
- * than being exempt from the comparison.
+ * The transport spelling, for the consumers that can only send one: the probe
+ * port carries a method, a path template, and the four transport channels.
  */
-export declare function suppliedKeys(inputs: WitnessInputs, channel: TransportChannelName): readonly string[];
+export declare const isApiWitnessInputs: (inputs: WitnessInputs) => inputs is ApiWitnessInputs;
+/**
+ * Whether the leg supplies this channel as an undifferentiated stream.
+ *
+ * Standard input written as text is one such stream. A `KeyedShapeDescriptor`
+ * can say what keys a channel carries and cannot say "one opaque stream", so a
+ * command that reads a prompt is declared by naming the one thing the stream
+ * carries, and the leg supplies that thing as the text it actually is.
+ */
+export declare function suppliesOpaquely(inputs: WitnessInputs, channel: InputChannelName): boolean;
+/**
+ * The keys one set of witness inputs supplies on one channel, or none where
+ * the leg's spelling has no such channel.
+ *
+ * `body` and `stdin` are the two channels a leg supplies as a tagged value
+ * rather than as a key map, because a leg has to tell an absent value from one
+ * carrying JSON null. This function is the bridge between that spelling and
+ * the keyed shape the request declares.
+ */
+export declare function suppliedKeys(inputs: WitnessInputs, channel: InputChannelName): readonly string[];
+/** One channel's supplied value, for the differential comparison. */
+export declare function suppliedValue(inputs: WitnessInputs, channel: WitnessChannel): unknown;
 /**
  * Every channel of one set of witness inputs against the operation that will
  * receive them. All four, not only the differential channel: `planPreflight`
@@ -49,7 +68,7 @@ export declare function suppliedKeys(inputs: WitnessInputs, channel: TransportCh
  * contract artifact, the surface AD-18 governs; a placeholder satisfies this
  * check, and what pre-flight probes is a fixture.
  */
-export declare function checkInputsAgainstShape(inputs: WitnessInputs, operation: Operation, owner: string, artifactPath: string): void;
+export declare function checkInputsAgainstShape(inputs: WitnessInputs, operation: AnyOperation, owner: string, artifactPath: string): void;
 /**
  * Strict-gated, alongside `checkUndeclaredMandatoryInput`, whose code this
  * shares: `compile.ts` already gates that code behind `options.strict`, and one